Profiling code execution
View Patent ↗Technologies for securing an electronic device may include determining a plurality of rules, monitoring execution of the electronic device, generating a notification that one of the operations has occurred based upon the rules, and, based on the notification and the pattern of the operations, determining whether the operations are indicative of malware. The rules may include an identification of a plurality of entities of the electronic device to be monitored, an identification of one or more operations between the entities to be monitored, and an identification of a pattern of the operations to be monitored.
1. A system for securing an electronic device, comprising:
a processor;
a non-transitory machine readable medium communicatively coupled to a hardware processor; and
an anti-malware module including instructions on the non-transitory machine readable medium, the instructions, when loaded and executed by the processor, cause the processor to:
identify a plurality of memory regions of the electronic device to be monitored, each memory region representing a respective CPU address space;
identify one or more operations representing transitions between the memory regions to be monitored, including an identification of an instruction fetch to be monitored;
identify a pattern of the operations to be monitored according to the identification of the instruction fetch, the pattern including a series of a plurality of defined operations representing transitions between a first memory region representing a kernel space and a second memory region representing a user space;
determine that the identified pattern of the operations has occurred;
generate and record a notification that the identified pattern of the operations has occurred;
based on the notification and the pattern of the operations, determine whether the identified pattern of the operations is indicative of malware; and
take corrective action in response to determining that the identified pattern of the operations has occurred and is indicative of malware.
2. The system of claim 1 , wherein the operations to be monitored include an execution branch between two of the memory regions.
3. The system of claim 1 , wherein the operations to be monitored include an instruction pointer change.
4. The system of claim 1 , wherein the anti-malware module further includes instructions to cause the processor to:
based on the notification and the pattern of the operations, identify an additional element of malware-access rule logic to be applied, the additional element comprising an identification of an additional entity, operation between entities, or pattern of operations to be monitored.
5. The system of claim 4 , wherein the notification includes an exception.
6. The system of claim 1 , wherein the pattern includes an enumeration of a number of times a monitored operation has been executed.
7. The system of claim 1 , wherein the pattern includes a series of a plurality of defined operations, the defined operations to include an enumeration of a maximum number of times a monitored operation is to be executed and be indicative of malware.
8. The system of claim 1 , wherein the pattern specifies a series of a plurality of operations including a first matched operation and a second matched operation, wherein a variable number of other operations are to be executed between the first matched operation and the second matched operation.
9. A method for securing an electronic device, comprising:
monitoring execution of the electronic device based on a set of malware-access rule logic;
identifying a plurality of memory regions of the electronic device to be monitored, each memory region representing a respective CPU address space;
identifying one or more operations representing transitions between the memory regions to be monitored, including an identification of an instruction fetch to be monitored;
identifying a pattern of the operations to be monitored according to the identification of the instruction fetch, the pattern including a series of a plurality of defined operations representing transitions between a first memory region representing a kernel space and a second memory region representing a user space;
generating and recording a notification that the identified pattern of the operations has occurred based upon the set of malware-access rule logic;
based on the notification and the pattern of the operations, determining whether the identified pattern of the operations is indicative of malware; and
taking corrective action in response to determining that the identified pattern of the operations is indicative of malware and has occurred.
10. The method of claim 9 , wherein the operations to be monitored include an execution branch between two of the memory regions.
11. The method of claim 9 , wherein the operations to be monitored include an instruction pointer change.
12. The method of claim 9 , further comprising, based on the notification and the pattern of the operations, determining an additional element of malware-access rule logic to be applied, the additional element comprising an identification of an additional entity, operation between entities, or pattern of operations to be monitored.
13. The method of claim 9 , wherein the notification includes a processor exception.
14. The method of claim 9 , wherein the pattern includes an enumeration of a number of times a monitored operation has been executed.
15. At least one non-transitory machine readable storage medium, comprising computer-executable instructions carried on the machine readable medium, the instructions readable by a processor, the instructions, when read and executed, for causing the processor to:
monitor execution of an electronic device based on a set of malware-access rule logic;
identify a plurality of memory regions of the electronic device to be monitored, each memory region representing a respective CPU address space;
identify one or more operations representing transitions between the memory regions to be monitored, including an identification of an instruction fetch to be monitored;
identify a pattern of the operations to be monitored according to the identification of the instruction fetch, the pattern including a series of a plurality of defined operations representing transitions between a first memory region representing a kernel space and a second memory region representing a user space;
generate and record a notification that the identified pattern of the operations has occurred based upon the set of malware-access rule logic;
based on the notification and the pattern of the operations, determine whether the identified pattern of the operations is indicative of malware; and
take corrective action in response to determining that the identified pattern of the operations is indicative of malware and has occurred.
16. The medium of claim 15 , wherein the operations to be monitored include an execution branch between two of the memory regions.
17. The medium of claim 15 , wherein the operations to be monitored include an instruction pointer change.
18. The medium of claim 15 , further comprising instructions for causing the processor to, based on the notification and the pattern of the operations, identify an additional element of malware-access rule logic to be applied, the additional element comprising an identification of an additional entity, operation between entities, or pattern of operations to be monitored.
19. The medium of claim 15 , wherein the notification includes a processor exception.
20. The medium of claim 15 , wherein the pattern includes an enumeration of a number of times a monitored operation has been executed.